In [1]}, authors defined honest-but-curious and malicious adversaries affecting FL scenarios. Honest-but-curious participants try to learn sensitive data and states of participants without deviating from the rules established by the FL training protocol. In contrast, malicious participants try to destroy or corrupt the model without restrictions. Besides, [2]} focuses on malicious insider participants and poisoning attacks. Poisoning attacks can be categorized according to different criteria. One criterion deals with the attack objective. In this sense, random attacks aim to reduce the accuracy of the trained FL model, whereas targeted attacks aim to influence the model to predict a given target label. Another criterion is to target the data used to train the local model. In this direction, clean-label data poisoning attacks assume that the adversary cannot change the label of any training data. Dirty-label attacks are when the adversary can introduce any number of data samples. Finally, backdoor poisoning attacks modify individual features or a few data samples to embed backdoors into the model. Overall, data poisoning attacks are less effective in settings with fewer participants.
